Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

modules/gitea/module.json

@@ -1,6 +1,7 @@
 {
   "module": "gitea",
   "version": "1",
+  "moved": true,
   "requires": [
     "postgres-database",
     "route",
@@ -156,11 +157,24 @@
       }
     }
   },
-  "settings": {
+  "config": {
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach the forge at, as a URL; unset, the code falls back to its environment, else this machine's gitea on its port.",
+      "trusted": true,
+      "default": ""
+    },
+    "agent-read-teams": {
+      "type": "object",
+      "description": "The read teams of the agents' forge accounts (ADR 0365 clause 3): each team by name, {\"<team>\": {\"repos\": [\"<owner>/<repo>\", ...], \"members\": [\"<node>\", ...]}}. The forge gets a team agent-read-<team> that reads only, with exactly those repositories and the accounts agent-<node>; a team taken out of the value is emptied. Nothing else on the forge is touched; an agent account is in no team until it is listed here.",
+      "trusted": true,
+      "default": {}
+    },
     "ready-authors": {
-      "kind": "preference",
-      "default": "mesh-tools mesh-admin jschoubben",
-      "why": "the forge accounts whose comment \"ready at <full head sha>\" marks a pull request ready for mesh-delivery to merge, separated by spaces: the account the forge's tools act as (novox/hq ADR 0365), the admin account for marks made before the tools acted as their own, and the operator's (novox/hq issue 722). A comment by any other account is ignored and said in the forge's log. Trusted: who may have a change merged is the operator's word"
+      "type": "string",
+      "description": "the forge accounts whose comment \"ready at <full head sha>\" marks a pull request ready for mesh-delivery to merge, separated by spaces: the account the forge's tools act as (novox/hq ADR 0365), the admin account for marks made before the tools acted as their own, and the operator's (novox/hq issue 722). A comment by any other account is ignored and said in the forge's log. Trusted: who may have a change merged is the operator's word",
+      "trusted": true,
+      "default": "mesh-tools mesh-admin jschoubben"
     }
   },
   "resources": [
@@ -182,7 +196,7 @@
       "path": "${dir:mesh-state}/ready-authors",
       "mode": "0600",
       "trusted": true,
-      "content": "# The accounts whose \"ready at <sha>\" comment marks a pull request ready (novox/hq issue 722), from the setting\n# ready-authors, written by the mesh. Replaced on every push; change the setting, never this file.\nauthors=${setting:ready-authors}\n"
+      "template": "files/ready-authors"
     },
     {
       "id": "forge-patches",
@@ -207,7 +221,7 @@
       "type": "file",
       "path": "${dir:state}/server.env",
       "mode": "0600",
-      "content": "GITEA__security__INTERNAL_TOKEN=${secret:internal-token}\nGITEA__database__DB_TYPE=postgres\nGITEA__database__HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nGITEA__database__NAME=${bound:postgres-database:as}\nGITEA__database__USER=${bound:postgres-database:as}\nGITEA__database__PASSWD=${secret:postgres-database}\nGITEA__webhook__ALLOWED_HOST_LIST=172.17.0.1\n"
+      "template": "files/server.env"
     },
     {
       "id": "data",
@@ -270,14 +284,53 @@
       ],
       "secrets-in-environment": "gitea honours GITEA__database__PASSWD__FILE and GITEA__security__INTERNAL_TOKEN__FILE; convertible, awaiting a bed that proves it"
     },
+    {
+      "id": "origins",
+      "type": "file",
+      "path": "${dir:mesh-state}/origins",
+      "mode": "0644",
+      "template": "files/origins"
+    },
     {
       "id": "runtime-config",
       "type": "file",
       "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
-      "content": "{}\n",
+      "template": "files/config.json",
       "merge": "json",
-      "takes-settings": []
+      "takes-config": [
+        "url"
+      ]
+    },
+    {
+      "id": "agent-teams-file",
+      "type": "file",
+      "path": "${dir:mesh-state}/agent-teams.json",
+      "mode": "0600",
+      "template": "files/agent-teams.json",
+      "merge": "json",
+      "takes-config": [
+        "agent-read-teams"
+      ]
+    },
+    {
+      "id": "agent-teams",
+      "type": "process",
+      "name": "gitea-agent-teams",
+      "artifact": "agent-teams",
+      "run": [
+        "./agent-teams"
+      ],
+      "run-once": true,
+      "env": {
+        "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+        "MESH_GITEA_ADMIN_USER": "mesh-admin",
+        "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+        "MESH_AGENT_TEAMS_FILE": "${dir:mesh-state}/agent-teams.json"
+      },
+      "restart-on": [
+        "agent-teams-file"
+      ]
     }
   ],
   "provides": [
@@ -292,6 +345,14 @@
     {
       "name": "git",
       "scope": "mesh"
+    },
+    {
+      "name": "gitea-read",
+      "scope": "mesh",
+      "credential": {
+        "issued-by": "software",
+        "tool": "gitea_agent_token"
+      }
     }
   ],
   "build": {
@@ -357,6 +418,39 @@
           "MESH_GITEA_TOKEN_FILE": "${dir:runtime-state}/token",
           "MESH_GITEA_PATCH_DIR": "${dir:forge-patches}"
         }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      },
+      {
+        "name": "agent-token",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/agent-token",
+        "binary": "agent-token",
+        "loads": [
+          "agent-token"
+        ],
+        "env": {
+          "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GITEA_ADMIN_USER": "mesh-admin",
+          "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_GITEA_ORIGINS_FILE": "${dir:mesh-state}/origins"
+        }
+      },
+      {
+        "name": "agent-teams",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/agent-teams",
+        "binary": "agent-teams",
+        "loads": [
+          "agent-teams"
+        ]
       }
     ]
   },